Question security

[mpj]

Hi people,

I'm new to Access and sorry if this is a newbie question but I'm migrating from Excel in an attempt to get a little more security.

I intend to transform a calculation system, originally developed in Excel, and add new functionalities.

It is a calculation oriented system so the database part "does not" have sensitive content.

The most important is the actual code!!!

So, I question if simply publishing my file in .accde format I guarantee the security of my code or can I still have problems?

 

[theDBguy]

Hi. As long as you put all your calculation code in a module, creating ACCDE file should keep them secured.

 

[plog]

What is your definition of "security"? What are you afraid of occuring?

 

[mpj]

What is your definition of "security"? What are you afraid of occuring?

I'm afraid that someone will be able to access the forms and modules and see my codes.

That's why I asked if my file in .accde format would protect my application or if for an advanced user, for example, this wouldn't be an impediment.

 

[theDBguy]

I'm afraid that someone will be able to access the forms and modules and see my codes.

That's why I asked if my file in .accde format would protect my application or if for an advanced user, for example, this wouldn't be an impediment.

Basically, if you create an ACCDE, no one should be able to see any code in a module. However, they can see the code in macros.

 

[isladogs]

Have a look at the info in my two part article:

Improve Access Security

This article summarises some of the main steps that developers should take to improve security in Access databases

www.isladogs.co.uk

The second part is a detailed tutorial and includes a sample database that you can use for testing purposes.
However, whilst you can lock down your database reasonable securely for most purposes, no Access database can ever be 100% secure from a skilled and determined hacker.

 

[GPGeorge]

Hi people,

I'm new to Access and sorry if this is a newbie question but I'm migrating from Excel in an attempt to get a little more security.

I intend to transform a calculation system, originally developed in Excel, and add new functionalities.

It is a calculation oriented system so the database part "does not" have sensitive content.

The most important is the actual code!!!

So, I question if simply publishing my file in .accde format I guarantee the security of my code or can I still have problems?

PMFJI: "Guarantee" is too strong a word, in any event. You can make it harder to steal your code, using the methods Colin suggests. Guarantee? Not possible.

BTW: Who are you worried about possibly wanting to steal your code?

 

[mpj]

Basically, if you create an ACCDE, no one should be able to see any code in a module. However, they can see the code in macros.

Thanks.

 

[mpj]

Have a look at the info in my two part article:
Isladogs.co.uk/improve-security/index.html

The second part is a detailed tutorial and includes a sample database that you can use for testing purposes.
However, whilst you can lock down your database reasonable securely for most purposes, no Access database can ever be 100% secure from a skilled and determined hacker.

Thank you for the link.

 

[mpj]

Why do you care if they see your code (not codes)? Unless you are selling this application, all you need to worry about is preventing accidental modifications.

That's my intention for the future.

 

[mpj]

PMFJI: "Guarantee" is too strong a word, in any event. You can make it harder to steal your code, using the methods Colin suggests. Guarantee? Not possible.

BTW: Who are you worried about possibly wanting to steal your code?

Mu intention for the future is to sell my system, so...

 

[KitaYama]

I've always wondered what the law says in cases like this.
In my profession, if we sell something, the drawing belongs to the customer not to us. Because they've ordered something, we have made the order and they have paid for it. (again in my profession : Manufacturing)

Just like a house. When we buy a house, the electric drawing, the construction drawing and any other details about the house belongs to us.

What about a software? If I order a software and someone make it for me, does the code belong to me or not?

Note: I think the code of a commercial software sold in market, doesn't belong to me. It's not written for me. I simply purchase something available.

 

[moke123]

I think that has to be spelled out in the contract. Who owns it and who has license to use it.

Many years ago my company partnered with a software company to develop a new system. While it was custom built for us, it was the software companies intention to market it to others. We were essentially their guinea pigs but in the long term we had no residual license fees.

 

[CJ_London]

It also depends under what conditions the app was built and the law of the land where you are.

I intend to transform a calculation system, originally developed in Excel, and add new functionalities.

If this transformation is being done during your employers time and therefore at their expense or you are being paid by someone to create the code, then technically the code belongs to them and not to you.

It is a grey area but it can also be argued that if the excel app was developed by your employer or others and you are simply 'translating' it to work on a different platform then they will have some rights over the new app, particularly if you do not have the skillset to have developed those algorithms/calculations originally and they are not in the public domain. It is one of the reasons you will see copyright notices all over complex working code examples you can find on the net, usually accompanied with a license setting out the terms under which it can be used.

@moke123 - hope your company had a good discount for acting as guinea pig!

 

[oleronesoftwares]

What about a software? If I order a software and someone make it for me, does the code belong to me or not?

If there was an agreement prior to sales, that the software developer will hand over the source code to the company then it belongs to the company, if not it belongs to the software developer.

 

[KitaYama]

If this transformation is being done during your employers time and therefore at their expense or you are being paid by someone to create the code, then technically the code belongs to them and not to you.

I doubt about it. Or at least it's different on this side of the ocean.

It's a famous story. A guy was employed in a company for more than 20 years as a researcher in a company. Finally he and his team developed the first blue LED light. All of a sudden, the company's stock went sky high.
The company paid more than a million dollar to each member of the team as a bonus for their hard work. But for the team's members, it wasn't enough.
The leader sued the company and asked for 5% of the whole blue LED income.
the company claimed they have paid them for more than 20 years without any result, all the expenses of those long years have been on the company, it's been their job to do what they did and a lot of other reasons.

To my surprise, the guy won and the company was ordered to pay an enormous amount of money, but not 5% of the whole income.
For the judge, it has been the hard work of the team that brought that success. And even if it's been their job and they have been paid, there are so many others that couldn't do what they did.

 

[mpj]

PS: I expressed myself wrongly earlier. In fact, my intention is to provide a service with an annual contract. For this reason I intend to protect my system in the best way possible since if I don't, a customer can easily not renew after twelve months.

 

[mpj]

That's a different problem. There are a number of ways to do this. If you are capable of building a web page, you can have the application "phone home" periodically and unless the app is authorized, it can refuse to work. That is the way O365 works.

Or, you can use a method like the one I use. I provide a "token" each year for the client to install. Encoded in the token is information on what features the client has paid for and what the expiration date of the token is. Then every time the database opens, the token is checked. It starts prompting the user three weeks out to renew. When it expires, the app refuses to go past the login screen. I can't give you the code I use but I can describe it if that is of interest.

I would appreciate it if you do.

 

[isladogs]

I also use the latter method but start the reminders 30 days before renewal with periodic reminders at decreasing intervals after that.

Once the user renews, they receive an authorisation code for another year which resets the renewal date for one year later.
If they choose not to renew, the application goes into restricted mode - basically read only - a few days after the deadline has passed.
That allows them to retain existing data and gives time for them to reflect on whether to renew later and restore full functionality.

I'm also not able to share my code for what I hope are obvious reasons

 

[LarryE]

In the US, you can copyright the code for about $35 through the US Patent Office. It's exactly the same process as if you wrote a song or lyrics or a book or article for a magazine. They consider code as intellectual property. You can do it online. The last time I did it, they wanted a document with the first and last 50 lines of code. I received my copyright certificate in the mail in about 10 weeks.